AI use policy for small businesses: how to use ChatGPT, Claude and Gemini safely

If someone on your team has already pasted a customer's email into ChatGPT to 'reply better', that's not unusual: it's the norm. AI saves hours, but everything you type into it leaves your business. Here's what data should never go in, which plans protect your data, what the law says and a 10-point AI use policy template. It's a practical guide, not legal advice: for your specific situation, check with your adviser or the APDA, Andorra's data protection authority.

What data should you never put into an AI?

Simple rule: if you wouldn't email it to a stranger, don't paste it into an AI on a personal account. In 2023 Samsung banned staff from using generative AI after discovering they had uploaded sensitive internal code to ChatGPT.

• Health data: records or treatments from clinics, physios or beauty salons.
• ID and banking: passports, account numbers, cards or payslips.
• Passwords and keys for your website, card terminal or online banking.
• Identifiable customers: your customer spreadsheet doesn't go into a free AI.
• Professional secrecy: law firm files or property deals not yet signed.
• Anything worth money: margins, strategy, contracts or source code.

Anonymise before pasting: 'Customer A' instead of the name, no phone numbers or addresses.

Do ChatGPT, Claude or Gemini train on your data? Free plans vs business plans

What matters isn't the brand, it's the plan. On personal plans, your chats may be used to improve the models unless you switch it off; on business plans, all four big providers commit to not training on your data by default. According to their official pages, as of October 2026:

Watch out: even with training switched off, rating a reply with a thumbs up or down may let OpenAI or Anthropic use that conversation. And if you already pay for Microsoft 365 or Google Workspace for business, you may already have protected AI at no extra cost: Copilot Chat comes with eligible licences, and Gemini has been part of Workspace Business plans since January 2025. If not, a Claude Team seat, for example, costs $25 a month ($20 billed annually), as of October 2026.

When you sign up, request the DPA (data processing agreement) and file it: it's the first thing the APDA would ask to see.

What do Andorra's Llei 29/2021 and the APDA say about using AI at work?

Andorra's Llei 29/2021 on personal data protection doesn't mention ChatGPT, but it applies the moment you put personal data into an AI. What matters most:

• Art. 5: only the data you need, handled securely and confidentially, and you must be able to prove you comply.
• Art. 9: processing health or biometric data is prohibited except in specific cases. A clinic shouldn't run patient records through an AI without a prior assessment.
• Art. 31: if the AI processes personal data on your behalf, you need a written contract with the provider (the DPA).
• Arts. 42 to 45: data leaving Andorra must go to destinations with EU-recognised adequate protection (such as US companies in the Data Privacy Framework) or with safeguards like standard contractual clauses.
• Art. 32: an impact assessment before high-risk processing, such as profiling people or processing health data at scale.
• Art. 25: the right not to be subject to decisions with legal effects made solely by automated means, subject to certain exceptions.

Fines range from €500 (minor) to €100,000 (very serious) under art. 73. The APDA does act: in 2025 it reprimanded two psychology practices for improperly exchanging clinical records. On AI, in November 2025 it reminded businesses that these systems are 'a language model, not a model of facts' and called for data protection by design and by default, both when setting up AI and when using it.

GDPR and the EU AI Act: do they affect an Andorran business?

Andorra isn't in the EU, but the GDPR applies to non-EU businesses offering goods or services to people in the EU (art. 3(2)): the hotel marketing to French guests or the online shop selling to Spain. Llei 29/2021 follows the GDPR model and the EU has recognised Andorra as providing adequate protection since 2010: comply here and you're a long way there.

The EU AI Act (Regulation (EU) 2024/1689) also reaches non-EU businesses when the AI's output is used in the EU (art. 2(1)(c)). The 'Digital Omnibus' reform (Regulation (EU) 2026/1744), in force since 27 July 2026, pushed back the high-risk rules. The timetable now looks like this:

For a small business using AI to write and summarise, three things already apply: promoting AI literacy among the people who use it, telling EU customers when a chatbot is an AI, and labelling images or video that imitate real people. Screening CVs with AI is high-risk.

And in Andorra? As of October 2026 there's no specific AI law. The Government does have an AI Code of Ethics: signing up to it is a requirement for the Andorra Digital grants, although it doesn't bind every business in general. Andorra did sign the Council of Europe Framework Convention on AI on 5 September 2024.

Hallucinations: why a person must always check

Generative AI doesn't look for the truth: it predicts words. That's why it sometimes invents, with complete confidence, an article of law, opening hours or a price. That's hallucination, and no provider has eliminated it.

The responsibility is yours. In 2024, a tribunal in British Columbia (Canada) ordered Air Canada to compensate a customer whose chatbot had promised a discount the airline's policy didn't allow: the company is responsible for all the information on its website. If you want an assistant that only answers from your own information and has clear limits, that's what we build with AI agents.

AI writes the draft, a person signs it off, especially for quotes, figures, regulations, contract translations and replies to customers.

Who owns what AI creates? Copyright

OpenAI, for example, states that outputs are yours 'to the extent permitted by law'. That's the catch: in January 2025 the US Copyright Office concluded that generated material can be protected where a person determines the creative elements, but that prompts alone are unlikely to be enough. In Andorra, the copyright law dates from 1999, long before generative AI.

In practice, a logo made purely with AI may be hard to defend if someone copies it. For branding and campaigns, add real human work and don't ask for anything 'in the style of' specific artists or brands.

Shadow AI: when your team uses personal accounts

Shadow AI means using AI tools the business hasn't approved, almost always on personal accounts. According to Microsoft's 2024 Work Trend Index, 78% of people who use AI at work bring their own tools; in small and medium-sized businesses, 80%.

Banning it doesn't work: people carry on, secretly and on their phones. What works is an official alternative, clear rules and short training. Our in-company AI workshops cover exactly that using cases from your sector, and the natural next step is to automate tasks with AI in a controlled way.

Ask your team, without pointing fingers, which AI they use and what for: that list is the starting point for your policy.

AI use policy template for small businesses (10 points)

Copy it, fill in the square brackets and have everyone sign it.

• Approved tools: only [ChatGPT Business / Claude Team / Copilot / Gemini], with the company account.
• Nothing in personal accounts: company information never goes into personal or free accounts.
• Prohibited data: health, ID documents, bank details, passwords and information under professional secrecy.
• Anonymise: customer and staff data is anonymised, except in tools approved to process it.
• Human review: anything going to customers, suppliers or the public is reviewed and signed off by a person.
• Verify: figures, regulations, prices and dates from AI are checked against a reliable source.
• No automated decisions: AI never decides alone on hiring, dismissals, credit or anything with legal effects.
• Transparency: customers are told when they're talking to a chatbot, and content imitating real people is labelled.
• Copyright: nothing 'in the style of' artists or brands; human work in logos and campaigns.
• Owner and training: [name] approves tools and is told of incidents the same day; training and review every six months.

Frequently asked questions

Free

Your AI use policy, tailored to your sector, free

Tell us what your business does and which tools you use. A member of our team will tailor the template to your sector and email it to you within 3 working days, with a training proposal for your team.

• AI use policy tailored to your sector: clinic, professional firm, shop, hotel, estate agency…
• A list of data your team should never put into an AI.
• A proposal for a practical half-day workshop, with no obligation.

A real person from the team replies, not a bot.

Name

Email

Your website (optional)

I have read and accept the privacy policy. Privacy

Send me my template Rather talk? WhatsApp · +376 866 044

Kim Capel

Founder of Visualtec (2005). AI, automation and SEO consultant with 20+ years in digital marketing.